In the example above, WKS1 is the computer where the user is logging onfrom, SUNKING is the domain controller authenticating the request, and theDescription contains the Windows NT domain account being used.

NOTE: The Src Mac Addr may also been shown as a media access control or IPaddress if the NetBIOS name could not be resolved or the entry is not inthe Network Monitor address database.

Using the WINS Database

To determine from which system a user logged on using the WINS database,perform the following steps:

Start WINS Manager.

Click Show Database on the Mappings menu.

Click Set Filter, type the user account name in the Computer Name criteria, and then click OK.

In the Mappings list, the entry with the user account name and the 03h identifier maps to the IP address of the workstation from which the user logged on to the domain.

Using the NetBIOS Remote Name Table

To determine from which system a user logged on using the NetBIOS RemoteName Table, perform the following steps:

From an MS-DOS command prompt, type the following, and then press Enter.

net send <user name> "text message"

where <user name> is the user account for the user you are attempting to locate.

Type the following, and then press Enter.

nbtstat -c

As in the example above using the WINS Database, locate the user name that is associated with the 03h identifier and the corresponding IP address is that of the workstation.

For more information, please refer to the following Microsoft KnowledgeBase articles: